Cloudflare Tunnel Safer Now? reddit / selfhosted ---------------------------------------------------------------------- 80Ships · 2023-10-24 06:23 I've seen a post on here before about Cloudflare tunnels being unsafe for exposing your locally hosted services to the web which I totally get. However I'm a bit of a noob with complex VPN set ups and I tried to get Wireguard working in Docker but couldn't. I got a tunnel configured and exchanged all the peer keys and things but I think my initial networking docker-compose stack was incorrect possibly. Also the windows client for it is a bit ugly but that's by the by. I've also used Tailscale in the past which is great but it feels like a temporary solution to me as you still have to remember ports and things (there may be a way around that if I remember correctly but I'd rather stay away from Tailscale. I prefer having control myself or through my domain name - probably illogical I know). Instead I decided to try to protect the Cloudflare tunnel to my home network and I've made a policy in Cloudflare Access that won't let you in without emailing you a code (only my email address works) and having you enter it. I'd also rather adjust that to my 2FA app but I can't seem to get that to work here. My question is: is that secure enough? And if not, what would you all suggest as an alternative (preferably an alternative that is pretty easy and means I can use my domain name)? ---------------------------------------------------------------------- ms_83 · 2023-10-24 06:55 How exactly are Cloudflare tunnels “unsafe”? And what makes you think VPNs are a better option? I’ve used CF quite a lot and the major downside is that you have to have decent authn/authz on at least one end of your tunnel but CF does not necessarily provide this. VPNs provide authn but not necessarily authz depending on the setup. In either case, how you set up and manage identities and credentials is key. ---------------------------------------------------------------------- 80Ships · 2023-10-24 06:59 The posts I was reading were just suggesting it was because anyone could access your login pages for the local services and if they could hack that, they could get into your admin panels. I guess as long as the Auth is secure enough it would be safe. I suppose that was what I was asking. Something about email doesn't sit right with me but it doesn't seem to let me use the MFA app but maybe that's just me not setting it up correctly. ---------------------------------------------------------------------- Whitestrake · 2023-10-24 07:12 In your Zero Trust dashboard, go to Settings, Authentication, Login methods, Add New. You can set up a SAML/OIDC provider (like Authelia or Authentik) or you can use Google, Facebook, Github etc; they've got specific instructions for all the latter. Then you use _those_ services' MFA instead; Cloudflare itself doesn't act as an identity provider, so you can't use Cloudflare's MFA to protect your applications. ---------------------------------------------------------------------- superglue_chute115 · 2023-10-24 08:23 One thing to keep in mind when using CF tunnels is that Cloudflare can see all of your server's traffic. If your goal is privacy I recommend staying away ---------------------------------------------------------------------- AnApexBread · 2023-10-24 10:17 >The posts I was reading were just suggesting it was because anyone could access your login pages That's literally the point of cloudflare Tunnels. It exposes services to the internet ---------------------------------------------------------------------- AnApexBread · 2023-10-24 10:24 >Cloudflare tunnels being unsafe for exposing your locally hosted services to the web That's the pout of Cloudflare Tunnels. It's a reverse proxy. Cloudflare Auth (zero trust) can lock down the tunnel so only certain people can access it. I want to clarify something though. Cloudflare Tunnels IS SAFE. But if you choose to use it in a not safe way that's not the fault of the tunnel. It's like putting on a bicycle helmet and then running on the freeway and wondering why your leg gets broken after getting hit by a car. "but I was wearing my helmet" great, but that wasn't the point of the helmet. ---------------------------------------------------------------------- kanersps · 2023-10-24 11:07 We use cloudflare tunnels in production for massive workloads at FiveM/Cfx.re, I can with 100% confidence say that I trust in it. Only caveat is that if you have rapid scaling, CF might accidentally route to a non existent tunnel, and if that doesn’t resolve itself you will have to recreate it. But this has only been an issue if you force shutdown some of the cloudflared instances. And only very intermittently, reproducing it has been difficult. ---------------------------------------------------------------------- Boomam · 2023-10-24 11:45 I wish people would stop making this statement. There's a difference between "seeing traffic" and "being able to understand what it is and do something about it". ---------------------------------------------------------------------- trisanachandler · 2023-10-24 12:05 I admit there is a level of trust needed in cloudflare, but I also need to trust the container makers, and the hardware manufacturers as well. I use cloudflare with O365 and jumpcloud for my auth sources and I've been thrilled. Different policies by subdomain, works great. ---------------------------------------------------------------------- EndlessHiway · 2023-10-24 12:27 How could they not understand what it is, since it is all decrypted. ---------------------------------------------------------------------- fedroxx · 2023-10-24 12:36 What posts did you read this? I use CloudFlare tunnels over VPN, and I also derive an immense amount of joy from reading posts by extremely stupid people. I'd like to read these posts. ---------------------------------------------------------------------- fedroxx · 2023-10-24 12:38 Privacy and security are two very different things. Unless someone is doing something stupid, like streaming movies over via tunnels, this is not a legitimate concern anymore than having a VPS hosted by Hetzner or any other provider who can root into it. ---------------------------------------------------------------------- 80Ships · 2023-10-24 12:58 https://www.reddit.com/r/selfhosted/s/u0EzSOz9Ye ---------------------------------------------------------------------- 80Ships · 2023-10-24 12:59 Thanks, noted. ---------------------------------------------------------------------- 80Ships · 2023-10-24 13:00 Makes sense. I was assuming that the people who were saying it wasn't safe were including the access control methods in that too for some reason. ---------------------------------------------------------------------- 80Ships · 2023-10-24 13:02 Yeah I'm not bothered about that, but I can see why some might be. All I care about is security. ---------------------------------------------------------------------- 80Ships · 2023-10-24 13:03 Gotcha, thanks. ---------------------------------------------------------------------- 80Ships · 2023-10-24 13:04 Good to know, thanks ---------------------------------------------------------------------- 80Ships · 2023-10-24 13:06 Yeah I know, sorry I phrased that badly, I meant that they were saying that was why it was insecure, rather than some security weakness with the tunneling itself. ---------------------------------------------------------------------- atheken · 2023-10-24 13:14 This is basically my config: ``` wireguard: container_name: wireguard image: weejewel/wg-easy volumes: - ./data/wiregaurd:/etc/wireguard environment: - WG_DEFAULT_DNS=192.168.10.3 - WG_HOST=public.example.com env_file: - ./env/wg-easy.secrets ports: - 51820:51820/udp - 51820:51820/tcp expose: - 51821 restart: always cap_add: - NET_ADMIN - SYS_MODULE depends_on: - pihole sysctls: - net.ipv4.ip_forward=1 - net.ipv4.conf.all.src_valid_mark=1 ``` In my case, I reverse proxy port `51821` through caddy to configure clients (with Authelia in front of it), but you could expose it interally only if you want to prevent that interface from being publicly accessible. Note that `public.example.com` needs to be replaced with your connection's public dns hostname (you can use something like duckdns for this if you want), and that you need to expose 51820 on your firewall/router. In my example above, `192.168.10.3` is the IP for pihole, and resolves some internal hostnames. You should look over the config provided once you set up a client and make sure it uses accessible hostnames, etc. I don't think there's any specific reason to worry about using cloudflare tunnels over any other VPN solution. ---------------------------------------------------------------------- JeremyMcFake · 2023-10-24 13:16 It is not un-safe. It's supposed to be used to expose services. You can put authentication on these if you want to make it only accessible to you or through many other conditions. The only way it's no safe is through user error. Exposing something like Vaultwarden with cloudflare tunnels, no authentication and a weak password is not very safe... Or just exposing a service that you haven't updated and there's a vulnerability in it. Otherwise it's really useful and safe. ---------------------------------------------------------------------- MyTechAccount90210 · 2023-10-24 13:28 Cloudflare is as safe as you design it to be. Once you're tunnel is set up, you configure and access app and set up whatever rules you want. For me personally, for ultra protected stuff like my proxmox management I require warp to be in use and then an email MFA code. Along of course with my proxmox login. ---------------------------------------------------------------------- nefarious_bumpps · 2023-10-24 13:49 I don't use CF. When you use them are you using their cert, or your own, to access your services? ---------------------------------------------------------------------- fedroxx · 2023-10-24 14:16 None of them are saying it is unsafe. They're saying CloudFlare can see the traffic -- that's assumed. It is no different than those who use external VPS providers for their VPN. Any system that is not hosted within your network and plays any part of encryption termination or someone from a company can access will have the same problem. You either choose to read their terms and trust your providers to an extent or go directly to your network via VPN. Those are the options. ---------------------------------------------------------------------- KN4MKB · 2023-10-25 03:47 Brother, there is no difference. I think you are confused. They can definitely "understand your traffic and do something about it" it's unencrypted, and you agree to a fairly strict terms of service that allows them to basically do whatever they like. ---------------------------------------------------------------------- 80Ships · 2023-10-25 07:15 Yeah this seems to be the opinion of the majority. I'll continue using cloudflare tunnels with authentication I think. ---------------------------------------------------------------------- 80Ships · 2023-10-25 07:16 I'll be setting up something similar I think. ---------------------------------------------------------------------- 80Ships · 2023-10-25 07:17 Thanks, that's a massive help, I may give it another go. ---------------------------------------------------------------------- Boomam · 2023-10-25 13:56 lol, I wont be re-arguing if you disagree on this, sorry. I know I'm right here as i have deployed this as part of my job - let me expound, just this once though - **This all comes down to configuration**   The claim that they decrypt and are some all seeing eye is a falsehood that certain parts of this community is spreading for reasons unknown. It needs to stop. Its down to config - Its as secure and private as you make it.   Configure it properly, and back it up with the right tools on your LAN side, and you're golden. Do it wrong, yeah, *technically* they can probably sniff some packets - but at the scale they work at, does anyone truly think that's viable?   Equally, lets look at their primary business model - at enterprise level you *have* to go through additional "security checks" and scrutiny for it to even be considered. If there was *any* risk or suggestion of a company like CF sniffing traffic over a service they pay for, in the manner being suggested, "because its unencrypted, i read it on reddit!!", then it simply wouldn't get to the market position its in, or have the customers it has.   It's that simple. ---------------------------------------------------------------------- KN4MKB · 2023-10-27 04:39 Nobody said they are actually decrypting your traffic to read it, and are doing so. That's just a strawman. Everyone is saying they can if they want to. (And they can). There's nothing "falsehood" about that statement. "Probably sniif some packets" also makes me think you may have actually no idea what you are saying anyways. It's their servers, they don't have to "sniff packets", they just capture them, and yes, they can capture all of them, not "some". I basically stopped reading there. I won't be replying any more to this as well, as it's no longer about disagreeing but just being willfully ignorant as indicated by your first sentence. That's okay for you, but it's not good to spread misinformation when it comes to people's data and security. I suggest you read up on the topic yourself after reading the first half of your reply.